Smart Accounts in Production: What We Learned the Hard Way

Smart accounts are usually presented as a solved problem: ERC-4337 handles execution, ERC-7579 makes accounts modular, session keys delegate, passkeys onboard users, paymasters pay for gas. We have run this stack in production for four years, first at wallet scale and then at institutional scale, and most of what we learned is not written down anywhere.

Onboarding breaks in ways no spec mentions once passkeys meet real devices and password managers. Recovery is easy to design and hard to operate when real users lose real phones. Session keys promise clean delegation, but scoping them right is harder than the standards suggest. Gas abstraction works until a UserOperation passes simulation and reverts on-chain, or a bundler rejects a valid one because fees moved. Modularity adds audit surface faster than it adds flexibility.

Every failure comes with the fix that held. Builders leave with concrete guidelines for assembling an account stack that real users can rely on.

Speakers: Ulaş Erdoğan, Alim Şahin

Track: Users, Builders, and Agents